We always find need to know which php files (Malware or otherwise) consuming the CPU and Server resources, so that you can fix those files.
FPM status page give this exact information. For that it needs to be enabled and configured in your apache confirguration where you want it to be displayed.
- Find where your FPM configuration is and edit
Update file for:
pm.status_path = /fpm7.4-status
- Restart FPM
sudo service php7.4-fpm restart
- Edit any of your website's Apache Configuration and add following LocationMatch directive.
<LocationMatch "/fpm7.4-status"> Order Allow,Deny Allow from all ProxyPass "unix:/run/php/php7.4-fpm.sock|fcgi://localhost/fpm7.4-status" </LocationMatch>
To secure this
/fpm7.4-status uri you can restrict it for IP by changing
Allow from 100.100.100.100
Once done reload apache configurations
sudo service apache2 reload
pid: 12840 state: Idle start time: 09/Apr/2023:12:32:10 +0530 start since: 583 requests: 43 request duration: 1390055 request method: POST request URI: /index.php content length: 0 user: - script: /var/www/html/index.php last request cpu: 92.08 last request memory: 23068672
pid - the PID of the process; state - the state of the process (Idle, Running, ...); start time - the date and time the process has started; start since - the number of seconds since the process has started; requests - the number of requests the process has served; request duration - the duration in µs of the requests; request method - the request method (GET, POST, ...); request URI - the request URI with the query string; content length - the content length of the request (only with POST); user - the user (PHP_AUTH_USER) (or '-' if not set); script - the main script called (or '-' if not set); last request cpu - the %cpu the last request consumed it's always 0 if the process is not in Idle state because CPU calculation is done when the request processing has terminated; last request memory - the max amount of memory the last request consumed it's always 0 if the process is not in Idle state because memory calculation is done when the request processing has terminated;